External Vulnerability Scan
Internet-facing systems only. We identify exposed services, known vulnerabilities, and misconfigurations visible from the outside. Ranked findings with a short written report and clear fix order.
- Good for a first look, insurance questionnaires, or confirming exposure
- Requires written authorization before any scanning begins
- No exploitation, no internal testing, no social engineering
- Deliverable: ranked findings, severity, and recommended fix order
Security Hygiene Review
Review of MFA, email security, backups, admin access, and basic policy gaps. You receive a written gap list suitable for insurers or customer security forms.
- Scoped and authorized
- Not a penetration test or SOC 2 attestation
- Practical recommendations you can act on
Static App Testing
Authorized review of mobile application code, packages, and configurations without running the app. We look for common issues in Android and iOS builds, hard-coded secrets, insecure configurations, and other static findings. Ranked with clear remediation guidance.
- Requires written authorization and access to source, packages, or builds as agreed
- Static analysis only — we do not run or dynamically test the app
- Deliverable includes prioritized findings and practical fixes
Ongoing Hygiene Retainer
Scheduled external checks against authorized domains. Findings are delivered to you. You are alerted if something material changes between runs. Monthly or quarterly options.
- Written authorization required
- Clear reporting cadence
Remediation Review (follow-up)
An optional follow-up to an External Vulnerability Scan or Security Hygiene Review with us. You apply the fixes; within the same authorized scope, we re-check and confirm what is closed and what remains open. Short closed/still-open note delivered to you.
Email Authentication & DNS Setup
SPF, DKIM, and DMARC set up correctly for your domain, then a guided move to DMARC enforcement so others can’t easily send mail that looks like it came from you.
- SPF/DKIM/DMARC setup, per domain
- Guided DMARC enforcement rollout (p=none → quarantine → reject) over 30–90 days
- Optional monthly DMARC monitoring and report
- You keep ownership of your accounts; we use delegated access, never shared passwords
- Backup and rollback plan before every change; nothing changes without a signed authorization
Secure Website Building & Migration
Small, fast websites built with security in mind, or a rebuild/migration off a hosted site builder. Our own site is the first case study: we moved it off Squarespace to a static site on Netlify.
- HTTPS and security headers set from day one
- Privacy-friendly analytics; no advertising or tracking pixels
- Accessibility work targeting WCAG 2.2 AA (a target, not a guarantee of legal compliance)
- You own the code and content once the project is paid in full
Pricing
Starting estimate: around $349. This is a non-binding estimate, not an offer. Your actual price is set in a written quote after a short scoping call and depends on scope. Prices do not include sales tax. Sales tax is added where required by law, based on the location where you receive the service, and is shown as a separate line on your invoice. Services received outside Washington are generally not subject to Washington sales tax. Business customers purchasing for resale may provide a valid reseller permit or exemption certificate. Projects under $1,000 are paid in full before work starts; $1,000 and up take a 50% deposit to schedule, with the balance due on delivery. Monthly plans are billed in advance and can be canceled with 30 days’ notice.